oauthenticator icon indicating copy to clipboard operation
oauthenticator copied to clipboard

[GitLab] Ability to choose what user data becomes the JupyterHub username

Open gsemet opened this issue 5 years ago • 3 comments

Today, we have username = resp_json["username"].

Would it be possible to add a switch to read the "name" field instead?

For example:

  {
    "id": 2,
    "username": "jack_smith",
    "name": "Jack Smith",
    "state": "blocked",
    "avatar_url": "http://gravatar.com/../e32131cd8.jpeg",
    "web_url": "http://localhost:3000/jack_smith"
  }

Our username field is pretty cryptic, we have the user name slug (without space, lowercase and) actually in the name field...

gsemet avatar May 15 '19 09:05 gsemet

Is this something you're interested in working on? Could it be done at a more generic level?

manics avatar Oct 13 '20 19:10 manics

I think it would be fine to have, and like @manics I also think it should be considered in the generic level before the GitLab specific level. I note that this is also a feature wanted for Auth0 in https://github.com/jupyterhub/oauthenticator/issues/266.

@minrk mentions this implementation in the GenericOAuthenticator

https://github.com/jupyterhub/oauthenticator/blob/397a3ec6b489635ceb70cfd40059d8ee55bddd6d/oauthenticator/generic.py#L31-L42

consideRatio avatar Oct 25 '20 23:10 consideRatio

Could this be made even more generic? the azuread.py uses username_claim, i.e.

c.AzureAdOAuthenticator.username_claim = 'unique_name'

but the claim I'm currently getting back from AzureAd has emails as a list:

{
   "exp":1619620646,
   "nbf":1619617046,
   "ver":"1.0",
   "iss":"https://xxx.b2clogin.com/xxx/v2.0/",
   "sub":"xxx",
   "aud":"xxx",
   "iat":1619617046,
   "auth_time":1619617046,
   "oid":"xxx",
   "name":"Mark Street",
   "given_name":"Mark",
   "family_name":"Street",
   "emails":[
      "[email protected]"
   ],
   "tfp":"B2C_1_Signin",
   "at_hash":"xxx"
}

A workaround is to either set an email in Azure for the user (i.e. set it twice) or change my name to my email address. Neither of which are obvious workflows.

If I could have a custom callback that takes the json_resp then I could do my magic there.

tfmark avatar Apr 28 '21 13:04 tfmark